Coruna iOS Exploit Kit Linked to Operation Triangulation, Millions of Devices at Risk

Key Points

• Coruna iOS exploit kit uses updated kernel exploit from Operation Triangulation campaign
• Kit targets 23 iOS vulnerabilities including CVE-2023-32434 and CVE-2023-38606
• Russian group UNC6353 using Coruna in attacks against Ukraine alongside DarkSword exploit
• Millions of devices running vulnerable iOS versions remain at risk

Full Details

Security researchers at Kaspersky have determined that the recently discovered Coruna iOS exploit kit contains an updated version of a kernel exploit originally used in Operation Triangulation, a sophisticated nation-state espionage campaign that began over three years ago. Coruna targets 23 vulnerabilities in iOS, including CVE-2023-32434 and CVE-2023-38606, two kernel bugs that were exploited as zero-days in Operation Triangulation. The exploit kit has been used by the Russian state-sponsored espionage group UNC6353 in attacks against Ukraine, alongside the DarkSword exploit kit which targets newer iOS versions. According to Kaspersky's report published March 27, 2026, the continued use of these exploits highlights the significant risk to millions of devices that remain running iOS versions containing the targeted vulnerabilities. The correlation between Coruna and Operation Triangulation demonstrates how sophisticated spyware tools are being continuously developed and refined by nation-state actors.